Skip to content

Commit

Permalink
Merge pull request #39 from timothyryanwalsh/dev-tskoptions
Browse files Browse the repository at this point in the history
Release 0.7.0
  • Loading branch information
Tim Walsh authored Oct 25, 2017
2 parents eac5542 + e52900c commit cdc9a75
Show file tree
Hide file tree
Showing 7 changed files with 1,192 additions and 725 deletions.
14 changes: 9 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Disk Image Processor

Analyze disk images and/or create ready-to-ingest SIPs from a directory of disk images and related files.
Version: 0.6.1 (beta)
Version: 0.7.0 (beta)

## Usage

Expand Down Expand Up @@ -63,6 +63,10 @@ The "metadata/submissionDocumentation" directory in each SIP contains:
* Text output from "disktype"
* Brunnhilde reports (including logs and reports from clamAV and, optionally, bulk_extractor)

### Process a single disk image, providing options to tsk_recover (CLI only)

Also included is a Python 3 script `process_with_tsk_options.py`. This script allows the user to create a SIP and corresponding description for a single disk image (and accompanying files) while specifying the file system type, image type, and sector offset as needed for `tsk_recover`. This script may be useful for certain disks for which tsk_recover is unable to extract files using its autodetection methods.

## Supported file systems

* NTFS
Expand All @@ -77,6 +81,8 @@ The "metadata/submissionDocumentation" directory in each SIP contains:
* SWAP
* YAFFS2

For disks with exfat file systems you may need to use the `process_with_tsk_options.py` script and explicitly specify the file system type. This is due to disktype's inability to recognize exfat file systems.

## Supported disk image types

* raw (dd, iso, img, etc.)
Expand All @@ -86,18 +92,16 @@ The "metadata/submissionDocumentation" directory in each SIP contains:

## Disk image extensions recognized

Disk Image Processor recognizes which files are disk images by their file extensions. Currently, it looks for the following extensions:
Disk Image Processor recognizes which files are disk images by their file extensions. Currently, it looks for the following extensions (case-insensitive):

* .E01
* .e01
* .000
* .001
* .raw
* .img
* .dd
* .iso

*To add extensions to this list, add them as elements in the tuple inside `file.endswith((".E01", ".000", ".001", ".raw", ".img", ".dd", ".iso"))` on line 353 of `diskimageprocessor.py` and/or line 261 of `diskimageanalyzer.py`.*

## Installation and dependencies

This utility is designed for easy use in BitCurator v1.8.0+. It requires Python 2.7 (to run the GUI) and Python 3.4+ (to run the scripts that analyze and process disk images), both of which are already included in BitCurator.
Expand Down
459 changes: 232 additions & 227 deletions diskimageanalyzer.py

Large diffs are not rendered by default.

Loading

0 comments on commit cdc9a75

Please sign in to comment.